wrong nlmsg_len?

[Stijn Souffriau]

Hello,

I'm sending a netlink message to the conntrack module using 
nfnl_ct_query and I'm letting libnl print out the message but I can't 
account for 4 bytes.

16 (header) + 4 (nfgen header) + 48 (attributes) = 68 = 72 - 4 bytes

I've edited the printout a bit to make it a bit more readable:


  [HEADER] 16 octets
     .nlmsg_len = 72
     .nlmsg_type = 257 <netfilter/ct::get>
     .nlmsg_flags = 5 <REQUEST,ACK>
     .nlmsg_seq = 1327500275
     .nlmsg_pid = 6479
   [PAYLOAD] 4 octets
     02 00 00 00

+struct nfgenmsg {
+    u_int8_t  nfgen_family;        /* AF_xxx */
+    u_int8_t  version;        /* nfnetlink version */
+    u_int16_t res_id;        /* resource id */
+} __attribute__ ((packed));

   [ATTR 01] 48 octets
14 00 01 00 : CTA_TUPLE_IP  len=20
08 00 01 00 : CTA_IP_V4_SRC  len=8
c0 a8 01 0c
08 00 02 00 : CTA_IP_V4_DST  len=8
c0 a8 01 42
1c 00 02 00 : CTA_TUPLE_PROTO len=28
05 00 01 00 : CTA_PROTO_NUM  len=8
06 00 00 00
06 00 02 00 : CTA_PROTO_SRC_PORT  len=8
da f6 00 00
06 00 03 00 : CTA_PROTO_DST_PORT  len=8
00 50 00 00

What and where are these 4 mysterious bytes?

Best regards,

Stijn
This message and any attachments herein are confidential, intended solely for the addressees and are SoftAtHome's ownership. Any unauthorized use or dissemination is prohibited. If you are not the intended addressee of this message, please cancel it immediately and inform the sender.